November 2022 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1204790] gcc12: don't require glibc-devel-32bit if %disable_32bit
by bugzilla_noreply＠suse.com 09 Nov '22

09 Nov '22

https://bugzilla.suse.com/show_bug.cgi?id=1204790 https://bugzilla.suse.com/show_bug.cgi?id=1204790#c6 --- Comment #6 from Richard Biener <rguenther(a)suse.com> --- I see quite a bunch of packages BuildRequiring glibc-devel-32bit: carla, dynamips, grub2, ispc, lsb, memtest86+, papi, qemu, vacation, valgrind and xen In the past on ppc that resulted in glibc-devel-64bit to be pulled so glibc-devel-32bit is magic for "the other multilib". Then there's another set of packages requiring gcc-32bit which also pulls glibc-devel-32bit (but gcc-32bit itself isn't magic). So yes, I think we still need -m32 support. Definitely for GCC development itself. Some of the above packages might also rely on the project config replacing glibc-devel-32bit with nothing. I think we might be able to replace the "hack" with %if "%{bi}" != "" BuildRequires: glibc-devel%{bi} %endif when %{bi} expands to -32bit, -64bit or %nil? Most issues will probably be noticed in the mips and sparc builds where main 32bit and 64bit multilib are still present. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1204819] VUL-0: chromium: multiple security issues fixed in 107.0.5304.87
by bugzilla_noreply＠suse.com 09 Nov '22

09 Nov '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1204819 http://bugzilla.opensuse.org/show_bug.cgi?id=1204819#c6 Andreas Stieger <Andreas.Stieger(a)gmx.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|IN_PROGRESS |RESOLVED Resolution|--- |FIXED --- Comment #6 from Andreas Stieger <Andreas.Stieger(a)gmx.de> --- done -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1204732] New: VUL-0: chromium: multiple security issues fixed in 107.0.5304.68
by bugzilla_noreply＠suse.com 09 Nov '22

09 Nov '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1204732 Bug ID: 1204732 Summary: VUL-0: chromium: multiple security issues fixed in 107.0.5304.68 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: gmbr3(a)opensuse.org Reporter: rfrohl(a)suse.com QA Contact: security-team(a)suse.de CC: Andreas.Stieger(a)gmx.de Found By: --- Blocker: --- CVE-2022-3652: Type Confusion in V8. Reported by srodulv and ZNMchtss at S.S.L Team on 2022-09-30 CVE-2022-3653: Heap buffer overflow in Vulkan. Reported by SeongHwan Park (SeHwa) on 2022-08-19 CVE-2022-3654: Use after free in Layout. Reported by Sergei Glazunov of Google Project Zero on 2022-09-19 CVE-2022-3655: Heap buffer overflow in Media Galleries. Reported by koocola(@alo_cook) and Guang Gong of 360 Vulnerability Research Institute on 2022-07-11 CVE-2022-3656: Insufficient data validation in File System. Reported by Ron Masas, Imperva on 2022-07-18 CVE-2022-3657: Use after free in Extensions. Reported by Omri Bushari, Talon Cyber Security on 2022-08-09 CVE-2022-3658: Use after free in Feedback service on Chrome OS. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Vulnerability Research Institute on 2022-08-14 CVE-2022-3659: Use after free in Accessibility. Reported by @ginggilBesel on 2022-08-23 CVE-2022-3660: Inappropriate implementation in Full screen mode. Reported by Irvan Kurniawan (sourc7) on 2022-05-20 CVE-2022-3661: Insufficient data validation in Extensions. Reported by Young Min Kim (@ylemkimon), CompSec Lab at Seoul National University on 2022-08-04 https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-des… -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1182241] [Build 20210211] multiple yast packages are not pre-installed in default gnome installation
by bugzilla_noreply＠suse.com 09 Nov '22

09 Nov '22

https://bugzilla.suse.com/show_bug.cgi?id=1182241 Dominique Leuenberger <dimstar(a)opensuse.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dimstar(a)opensuse.org, | |hel(a)lcp.world Flags| |needinfo?(hel(a)lcp.world) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1204157] Plank not working properly on Pantheon
by bugzilla_noreply＠suse.com 09 Nov '22

09 Nov '22

https://bugzilla.suse.com/show_bug.cgi?id=1204157 https://bugzilla.suse.com/show_bug.cgi?id=1204157#c5 --- Comment #5 from Dude <le0nard(a)posteo.net> --- Created submit request https://build.opensuse.org/request/show/1034874. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1205243] VUL-0: CVE-2022-45059: varnish: HTTP request smuggling via hop-by-hop headers
by bugzilla_noreply＠suse.com 09 Nov '22

09 Nov '22

https://bugzilla.suse.com/show_bug.cgi?id=1205243 Marcus R�ckert <mrueckert(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC|mrueckert(a)suse.com | -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1205242] VUL-0: CVE-2022-45060: varnish: HTTP request forgery via character injection through HTTP/2 pseudo-headers
by bugzilla_noreply＠suse.com 09 Nov '22

09 Nov '22

https://bugzilla.suse.com/show_bug.cgi?id=1205242 Marcus R�ckert <mrueckert(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC|mrueckert(a)suse.com | -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1198618] systemd-boot: openSUSE branding
by bugzilla_noreply＠suse.com 09 Nov '22

09 Nov '22

https://bugzilla.suse.com/show_bug.cgi?id=1198618 https://bugzilla.suse.com/show_bug.cgi?id=1198618#c6 --- Comment #6 from Franck Bui <fbui(a)suse.com> --- (In reply to Ludwig Nussel from comment #4) > Well, upstream thinks there's only one instance of sd-boot. In practice it's > installed by a specific distribution so in the end different distros will > again compete about that entry. So IMO we should still label that with > openSUSE. Then can you please start a discussion on this topic with upstream ? Otherwise I fear that your feature request won't be addressed, especially since BZ is supposed to track issues only. Thanks. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1204860] [SELinux] Installed selinux (after fresh install): no labeling, got locked out
by bugzilla_noreply＠suse.com 09 Nov '22

09 Nov '22

https://bugzilla.suse.com/show_bug.cgi?id=1204860 https://bugzilla.suse.com/show_bug.cgi?id=1204860#c7 --- Comment #7 from Thorsten Kukuk <kukuk(a)suse.com> --- (In reply to OpenSUSE Account from comment #6) > To clarify: I am new to this distribution. The package seemed like the > obvious way to go. I will keep an eye out of "patterns" as these are > apparently called in SUSE. I noticed that they correspond with the > "groups"/"main categories" (if I may call them that) of YaST Software > Management. > The "dubious package" in question is part of the SUSE ecosystem. There is no > clear difference for me. If at all, this package is part of the openSUSE ecosystem. And yes, this package is needed for openSUSE, and that's why it has to be there. If we would remove it, we would break the use cases on openSUSE where it is required. We have different packages for different usecases, and you did mixed all this packages up. Unfortunately, it's not possible to express RPM dependencies based on "use cases". So if I want to use something complex like SELinux, you either have to start learning it (yes, this takes a lot of time and is not easy, as SELinux is complex and not easy), or tell YaST during installation to use SELinux instead of AppArmor in the Security section. Installing all or random packages with "selinux" in the name will in no case lead to success. Which is true for many other functionality, too. If it does, it's more by pure luck then by design. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1204860] New: Installed selinux on fresh install: no labeling, got locked out
by bugzilla_noreply＠suse.com 09 Nov '22

09 Nov '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1204860 Bug ID: 1204860 Summary: Installed selinux on fresh install: no labeling, got locked out Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: opensuse.k1akb(a)slmail.me QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I am not sure if this is still an issue, but I want to make sure it is known. I have an issue which *seems to be* described here: # 1199520. I am not sure if this is exactly the same issue/consequence/solution, so I would like to leave this information to be sure. I installed selinux soon after a fresh installation of OpenSUSE Tumbleweed: first installed selinux and the 'targeted' profile, then realized I was missing a component so I installed selinux-targeted-setup. After rebooting, I was locked out of the system, presumably because access to the shell was denied to all users. (At this point no relabeling had taken place.) I could not fix this with 'restorecon -Rv /', because this was an NOOP execution. I am not sure why, I do not know selinux well enough, the command just immediately exits. Then I noticed that '/etc/selinux/.autorelabel' was created -- and still existed -- and moved this to '/' and on next boot the relabeling process started and the issue resolved itself. From then on, I have not encountered any (noticable) issues. -- You are receiving this mail because: You are on the CC list for the bug.

1 5